CWE-346.

@misskey-dev/summaly allows IP Filter Bypass via Redirect

• CWE-346

>=5.1.0, <5.2.1 · fixed in 5.2.1

Origin validation error in kitty

• kitty
• CWE-346

Command Injection in iManage Work Desktop for Mac's Agent Service

• iManage Work Desktop for Mac
• Information disclosure
• CWE-346

Origin validation error in Google Chrome

• Google Chrome
• CWE-346

xiaomi shop application Webview has code execution vulnerability

• Xiaomi shop application
• CWE-346

quick App has intent redriction vulnerability

• Xiaomi quick app framework
• CWE-346

Xiaomi smarthome application Webview has code execution vulnerability

• Xiaomi smarthome application
• CWE-346

Prefect CORS (Cross-Origin Resource Sharing) misconfiguration

• CWE-346

<2.20.17 || >=3.0.0rc1, <3.0.3 · fixed in 2.20.17, 3.0.3

Flask-CORS allows for inconsistent CORS matching

• CWE-346

<6.0.0 · fixed in 6.0.0

Feast Cross-Origin Resource Sharing vulnerability

• CWE-346

<=0.40.0 · no fixed version yet

A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only truste...

• CWE-346

<=0.0.4 · no fixed version yet

Cross-Site WebSocket Hijacking in binary-husky/gpt_academic

• binary-husky/gpt_academic
• CWE-346

CORS Misconfiguration in netease-youdao/qanything

• netease-youdao/qanything
• CWE-346

CORS Misconfiguration in danswer-ai/danswer

• danswer-ai/danswer
• CWE-346

IROAD Dash Cam X5/Dash Cam X6 Domain origin validation

• IROAD Dash Cam X5
• IROAD Dash Cam X6
• CWE-345
• CWE-346

Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes

• misskey
• CWE-346
• CWE-441

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests t...

• CWE-346

<2.0.58 · fixed in 2.0.58

Origin validation error in Ubiquiti Inc UniFi Protect Cameras

• Ubiquiti Inc UniFi Protect Cameras
• CWE-346

Origin validation error in Q-Free MaxTime

• Q-Free MaxTime
• CWE-346

esbuild enables any website to send any requests to the development server and read the response

• CWE-346

<0.25.0 · fixed in 0.25.0

Mindskip xzs-mysql 学之思开源考试系统 CORS cross-domain policy

• Mindskip xzs-mysql 学之思开源考试系统
• CWE-346
• CWE-942

Anonymous cache poisoning via XHR requests in Discourse

• discourse
• CWE-346

Anonymous cache poisoning via request headers in Discourse

• discourse
• CWE-346

Origin validation error in axios

• axios
• CWE-346

Origin validation error in Oracle Corporation Oracle Communications Order and Service Management

• Oracle Corporation Oracle Communications Order and Service Management
• CWE-346

Origin validation error in Oracle Corporation JD Edwards EnterpriseOne Tools

• Oracle Corporation JD Edwards EnterpriseOne Tools
• CWE-346

Origin validation error in Oracle Corporation MySQL Server

• Oracle Corporation MySQL Server
• CWE-346

Origin validation error in Oracle Corporation JD Edwards EnterpriseOne Tools

• Oracle Corporation JD Edwards EnterpriseOne Tools
• CWE-346

Websites were able to send any requests to the development server and read the response in vite

• CWE-346
• CWE-350

<4.5.6 || >=5.0.0, <5.4.12 || >=6.0.0, <6.0.9 · fixed in 4.5.6, 5.4.12, 6.0.9

Origin validation error in Fortinet FortiProxy and others

• Fortinet FortiProxy
• Fortinet FortiOS
• CWE-346

Address bar spoofing on iOS using long hostnames

• Mozilla Firefox for iOS
• CWE-346

Origin validation error in Trend Micro, Inc. Trend Micro Apex One and others

• Trend Micro, Inc. Trend Micro Apex One
• Trend Micro, Inc. Trend Micro Apex One as a Service
• CWE-346

Origin validation error in Oracle Corporation Oracle Linux

• Oracle Corporation Oracle Linux
• CWE-346

Improper input validation in Huawei CV81-WDM FW

• Huawei CV81-WDM FW
• CWE-20
• CWE-346

A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0.

• CWE-346

Origin validation error in Apple Safari and others

• Apple Safari
• Apple iOS and iPadOS
• CWE-346

Origin validation error in Apple macOS

• Apple macOS
• CWE-346

pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion

• CWE-346
• CWE-426

<9.15.0 · fixed in 9.15.0

MSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking.

• CWE-346

An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to cause a Denial of Service (DoS) via ECU reset UDS service.

• CWE-346

Improper Access Control in Dataprom Informatics' PACS-ACSS

• Dataprom Informatics Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS)
• CWE-346

An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function.

• CWE-346

lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quantity limit by capturing and sending the data packets for coupon collection in hi…

• CWE-346

Data Leak through CORS Misconfiguration in parisneo/lollms-webui

• parisneo/lollms-webui
• CWE-346

Origin validation error in Mozilla Firefox and others

• Mozilla Firefox
• Mozilla Firefox ESR
• CWE-346

Incorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction request to the server.

• CWE-346

Gradio's CORS origin validation accepts the null origin

• Broken access control
• CWE-346

<5.0.0 · fixed in 5.0.0

Gradios's CORS origin validation is not performed when the request has a cookie

• Broken access control
• CWE-346

<4.44.0 · fixed in 4.44.0

Origin validation error in Mozilla Firefox and others

• Mozilla Firefox
• Mozilla Firefox ESR
• CWE-346

Origin validation error in Mozilla Firefox and others

• Mozilla Firefox
• Mozilla Firefox ESR
• CWE-346

Origin validation error in Apple Safari and others

• Apple Safari
• Apple iOS and iPadOS
• CWE-346

Origin validation error in Google Chrome

• Google Chrome
• CWE-346

Tailscale Windows daemon is vulnerable to RCE via CSRF in tailscale.com

• Cross-site request forgery (CSRF)
• CWE-346

<1.32.3 · fixed in 1.32.3

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration.

• CWE-346

Local Privilege Escalation on Zscaler Client Connector on Windows

• Zscaler Client Connector
• CWE-346

Flowise Cors Misconfiguration in packages/server/src/index.ts

• CWE-346

<=1.4.3 · no fixed version yet

Origin validation error in Sky Co.,LTD. SKYSEA Client View

• Sky Co.,LTD. SKYSEA Client View
• CWE-346

Permissions and Access Control Vulnerability in ZTE ZXCLOUD IRAI

• ZTE ZXCLOUD IRAI
• CWE-346

Data leak through CORS misconfiguration in stitionai/devika

• stitionai/devika
• CWE-346

Gin mishandles a wildcard at the end of an origin string

• CWE-346

<1.6.0 · fixed in 1.6.0